Opaque identifiers — one counter per domain. All are transparent newtypes so serde emits them as plain numbers.